ADDRESSING OBSTACLES TO CYBER-ATTRIBUTION: A MODEL BASED ON STATE RESPONSE TO CYBER-ATTACK

Transcription

1 ADDRESSING OBSTACLES TO CYBER-ATTRIBUTION: A MODEL BASED ON STATE RESPONSE TO CYBER-ATTACK CHRISTIAN PAYNE* AND LORRAINE FINLAY** INTRODUCTION The international law of jus ad bellum the law surrounding the use of force by states outside of armed conflict has always been fraught with political complications and potential legal ambiguity. 1 As states have become increasingly dependent on information technology, attack methods targeting information technology infrastructure have begun to receive recognition as a significant issue in the application of jus ad bellum. 2 While milestone cyberattacks against Estonia in 2007 and the Stuxnet attack against Iran in 2010 are relatively well-known, 3 numerous other states have found themselves victims. 4 Consequently the United States and United Kingdom have both recognized cyber-attack as a major threat to their respective national securities. 5 Cyber-attacks have properties that make them quite different from existing modes of warfare, and it remains uncertain precisely * Lecturer, School of Engineering and Information Technology, Murdoch University. Ph.D. 2010, Murdoch University; B.Sc. 1999, Murdoch University. ** Lecturer, School of Law, Murdoch University. LL.M. 2009, New York University; LL.M. 2009, National University of Singapore; LL.B. 2003, University of Western Australia; B.A. 2003, University of Western Australia. 1. See Albrecht Randelzhofer, Article 2(4), in THE CHARTER OF THE UNITED NATIONS: A COMMENTARY (Bruno Simma et al. eds., 1994). 2. See, e.g., TALLINN MANUAL ON THE INTERNATIONAL LAW APPLICABLE TO CYBER WAR- FARE, 1 3 (Michael N. Schmitt ed., 2013); Marco Roscini, World Wide Warfare Jus Ad Bellum and the Use of Cyber Force, in 14 MAX PLANCK YEARBOOK OF U.N. LAW 85, 87 (2010). 3. See Michael N Schmitt, The Law of Cyber Warfare: Quo Vadis?, 25 STAN. L. & POL Y REV. 269, 269 (2014) (arguing that the attacks on Estonia brought the issue of cyber-attack onto the international agenda); John Richardson, Stuxnet as Cyberwarfare: Applying the Law of War to the Virtual Battlefield, 29 J. MARSHALL J. COMPUTER & INFO. L. 1, 8 (2011) (discussing Stuxnet as the first cyber-attack by a state to have caused physical damage). 4. See Roscini, supra note 2 at (2010). 5. WHITE HOUSE, NATIONAL SECURITY STRATEGY 27 (2010) (calling cyber-attack one of the most serious national security... challenges that the United States faces); WHITE HOUSE, NATIONAL SECURITY STRATEGY 1 (2015) (specifically acknowledging the growing danger of disruptive and destructive cyber-attacks); HM GOVERNMENT, A STRONG BRITAIN IN AN AGE OF UNCERTAINTY: THE NATIONAL SECURITY STRATEGY 11 (2010) (indicating that cyber-attack is one of the four highest priority risks the United Kingdom faces). 535

2 536 The Geo. Wash. Int l L. Rev. [Vol. 49 how public international law should deal with this new mode of attack. 6 In particular, it is unclear whether existing legal rules are suitably equipped to deal with the novel characteristics of cyberwarfare, or instead, if and to what degree new rules need to be developed. 7 The result is a raft of partly legal and partly technical questions, generally without clear answers. Although there has been much scholarly writing on the subject, state practice varies and there is no international jurisprudence to assist with these specific questions. 8 Indeed, the only extant legal rules on the topic are those proposed by scholars. 9 The academic literature has therefore had an unusually large impact on the understanding of the law in this emerging area. Although scholars have analyzed a range of issues surrounding the law of cyber-attack, the question of how to attribute state responsibility in the event of a cyber-attack has been recognized as a significant hurdle. 10 Indeed, national security law expert Daniel B. Silver has described attribution as the most important practical obstacle to applying the law of jus ad bellum to cyber-attack. 11 This Article discusses some of the legal issues surrounding cyberattack generally, and cyber-attribution in particular. Leveraging existing jurisprudence, established international law, and state practice, it proposes a model for cyber-attribution that minimizes the risk of conflict escalation and encourages states to cooperate and pursue peaceful means of resolving disputes arising from cyber-incidents. The Article begins in Part I by providing a brief overview regarding the nature of cyber-attacks, and particularly some of their unusual properties. Part II follows with a review of the rules of jus ad bellum, especially the prohibition against force and the right of self-defense. Part III then outlines states lawful options when responding to cyber-attack, focusing on how the rules of jus ad bel- 6. See Schmitt, supra note 3, at Id. 8. See Lianne J.M. Boer, Restating the Law As It Is : On the Tallinn Manual and the Use of Force in Cyberspace, 5 AMSTERDAM L.F. 4, 5 (2013). 9. See id. 10. Scott J. Shackelford & Richard B. Andres, State Responsibility for Cyber Attacks: Competing Standards for a Growing Problem, 42 GEO. J. INT L L. 971, 981 (2011); David E. Graham, Cyber Threats and the Law of War, 4 J. NAT L SEC. L. & POL Y 87, 92 (2010); Matthew C. Waxman, Cyber-Attacks and the Use of Force: Back to the Future of Article 2(4), 36 YALE J. INT L L. 421, 445 (2011). 11. See Daniel B. Silver, Computer Network Attack as a Use of Force Under Article 2(4) of the United Nations Charter, in 76 COMPUTER NETWORK ATTACK & INTERNATIONAL LAW 73, 78 (Michael N. Schmitt & Brian T. O Donnell eds., 2002).

3 2017] Addressing Obstacles to Cyber-Attribution 537 lum may apply to this emerging form of conflict. Part IV then discusses the problems that cyber-attribution poses which practically inhibit the ability to apply existing international laws to cyberattack scenarios. Finally, Part V presents and discusses a model that aims to resolve these problems. I. THE NATURE OF CYBER-ATTACK For the purposes of this Article, cyber-attacks are defined as those whereby states utilize computers and information technology as the primary mechanisms to detrimentally impact the interests of another state. In short, cyber-attack involves information technology employed as a weapon. Although some definitions of the term might include traditional kinetic attacks targeted at computing infrastructure, 12 a more useful definition when concentrating on the unique characteristics of cyber-attacks and the challenges these present focuses on the notional weapon rather than the target. 13 Cyber-attacks involve a variety of attack mechanisms, targets, and consequences, which makes difficult clear identification of a common set of characteristics, compared with traditional kinetic attacks. 14 Combined with the relative newness of cyber-attack, these attributes create the potential for significant legal ambiguity. Moreover, the complexity and flexibility of reprogrammable computer systems produce a seemingly infinite variety of potential attack methods. 15 The outcomes and constraints of these methods will generally depend upon the precise details of specific systems and their vulnerabilities. Consequently, any attempt at a definitive taxonomy is likely to have a degree of artificiality and be, at best, only temporarily accurate. For this reason, for the purposes of this Article, cyber-attacks are instead classified into one or more of three general categories. First, direct intrusion attacks are those where the attacker directly interacts with a computer system and gains some form of unauthorized access or control. Second, indirect intrusion attacks involve malicious code or malware that the attacker constructs in order to compromise a set of systems. 16 In most cases this code will 12. Oona A. Hathaway et al., The Law of Cyber-Attack, 100 CAL. L. REV. 817, 826 (2012). 13. Silver, supra note 11, at 75 76; Michael N. Schmitt, Computer Network Attack and the Use of Force in International Law: Thoughts on a Normative Framework, 37 COLUM. J. TRANSNAT L L. 885, 891 (1999). 14. Schmitt, supra note 13, at See generally BRUCE SCHNEIER, SECRETS & LIES: DIGITAL SECURITY IN A NETWORKED WORLD (2000) (explaining the implications of software complexity). 16. MATT BISHOP, COMPUTER SECURITY: ART AND SCIENCE (2003).

4 538 The Geo. Wash. Int l L. Rev. [Vol. 49 be self-propagating, delivering a payload in the form of specific actions once it gains access to a system. 17 Third, denial of service attacks involve rendering the system unable to provide its expected services. 18 A common variant of these is the distributed denial of service attack whereby large numbers of computer systems are compromised and used to collectively overwhelm a target with meaningless messages. 19 Cyber-attack of any type provides an attacker with significant advantages, making it highly asymmetric in nature. 20 To begin with, cyber-warfare is typically inexpensive for the attacker. 21 By one estimate, a devastating cyber-attack on the United States with damage lasting for many years could be deployed for approximately the cost of a single fighter aircraft. 22 Unlike traditional kinetic warfare, a cyber-attack can be launched by a single appropriately skilled individual with a computer, an Internet connection, and a relatively small financial stake. The vulnerability of states to cyber-attack also varies significantly. 23 States with a greater investment in, and therefore dependence on, information technology have far greater potential exposure than those which are still developing in this area. 24 Nations with extensive information technology infrastructures will often also be economically and militarily strong; 25 notionally powerful states are therefore likely to be far more vulnerable to cyberattack than other means of coercion such as kinetic warfare or economic action. 26 Finally, the legal and factual ambiguity associated with cyber-warfare makes this a relatively safe mechanism for a prospective aggressor to employ. A victim state may simply not have sufficient evidence to prove who attacked it, and indeed may not even know 17. Id. at , SCHNEIER, supra note 15, at Id. at John Dever & James Dever, Cyber Warfare: Attribution, Preemption, and National Self Defence, 2 J. L. & CYBER WARFARE 25, 26 (2013). 21. Schmitt, supra note 13, at Id. at 898. According to the figures used by Schmitt in his 1999 article, it would take approximately US$30,000,000 to devastate the United States information infrastructure for many years while a single F-16 aircraft would cost US$26,000,000. Id. 23. Id. at Id. 25. See e.g., id. ( The technological and fiscal wherewithal of the developed states underlies an unprecedented level of military and economic supremacy. ). Cf. Waxman, supra note 10, at (security of technology creates a risk for the United States because its high economic and military dependency on information technology ). 26. Dever & Dever, supra note 20, at 26.

5 2017] Addressing Obstacles to Cyber-Attribution 539 the identity of the perpetrator. 27 This problem is known as cyberattribution, the principal focus of this Article. II. EXISTING PRINCIPLES OF JUS AD BELLUM The fundamental principles of jus ad bellum are well established. However, their precise application is often still subject to significant debate and disagreement. This Part summarizes these general principles as a basis for later discussion of how this law applies in relation to cyber-attack. A. Prohibition on the Use of Force The prohibition against the threat or use of force is expressly articulated in the Charter of the United Nations (Charter) Article 2, Paragraph 4, and is considered to be a peremptory norm of international law. 28 Notable instruments that preceded Article 2(4), such as the Kellogg-Briand Pact, were framed as condemning war specifically, and thereby allowed military action that could be classified as action other than actual war. 29 Article 2(4) remedied this potential loophole and sought to more thoroughly mitigate the risk of war by framing the prohibition in terms of force generally. 30 However, with this approach the Charter framed wrongfulness in expressly instrumental terms, constrained by what is understood to constitute force. This potential ambiguity has led to debate as to whether the prohibition encompasses armed force or can be extended to economic coercion. 31 The general consensus is that Article 2(4) refers only to armed force, and economic coercion is not included. 32 Nonetheless, some arguments support a wider interpretation. 33 The same question arises with regards to nonmilitary physical force, although again a conservative approach prevails that generally excludes economically coercive acts from the prohibition on force. 34 In contrast, there is a strong consensus 27. Oliver Kessler & Wouter Werner, Expertise, Uncertainty, and International Law: A Study of the Tallinn Manual on Cyberwarfare, 26 LEIDEN J. INT L L. 793, 799 (2013). 28. Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.), Judgment, 1986 I.C.J. 14, 190 (June 27). 29. Randelzhofer, supra note 1, at Id. at Id. at Id.; Waxman, supra note 10, at 427; Schmitt, supra note 13, at Michael N. Schmitt, Cyber Operations and the Jus Ad Bellum Revisited, 56 VILL. L. REV. 569, 574 (2011). 34. Randelzhofer, supra note 1, at 113.

6 540 The Geo. Wash. Int l L. Rev. [Vol. 49 that indirect force against another state involving the use of irregulars or rebels will generally breach the prohibition. 35 The cognitive shortcut employed by the drafters of the Charter in terms of force as a coercive mechanism 36 has also led to questions about its applicability to new forms of weaponry. 37 This issue has led to the practical adoption of an approach to evaluating force that focuses primarily on the consequences, rather than the means employed. 38 B. The Right to Self-Defense 1. Article 51 and Armed Attack The Charter s Article 51 provides that nothing in that document shall impair the inherent right of... [self-defense] if an armed attack occurs. 39 This provision points to the origins of the right to self-defense in customary international law. 40 However, until the advent of the prohibition against war, and ultimately also against the use of force, the right to self-defense was of limited practical legal significance. 41 With the constraints on states that now exist by virtue of the Charter and the subsequent evolution of international norms, the nature and limits of this right have gained significance as one of the few ways that a state may unilaterally, lawfully use force. 42 As expressed in Article 51, the first constraint on the right to selfdefense is that it applies only in the event of an armed attack. 43 Despite its origins in custom, the Charter states that it does not impair the inherent right to self-defense if an armed attack occurs, arguably implying that any previous customary right to self-defense that may have existed in the absence of such an attack has been 35. Id. at But see id. at 115; Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.), Judgment, 1986 I.C.J. 14, 228 (June 27). 36. Schmitt, supra note 33, at IAN BROWNLIE, INTERNATIONAL LAW AND THE USE OF FORCE BY STATES 362 (1963); Schmitt, supra note 13, at BROWNLIE, supra note 37; Legality of the Threat or Use of Nuclear Weapons, Advisory Opinion, 1996 I.C.J. 226, 39 (July 8); Schmitt, supra note 33, at 573; Russell Buchan, Cyber Attacks: Unlawful Uses of Force or Prohibited Interventions?, 17 J. CONFLICT & SEC. L. 211, 217 (2012). 39. U.N. Charter art See also Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.), Judgment, 1986 I.C.J. 14, 176 (June 27). 41. Albrecht Randelzhofer, Article 51, in THE CHARTER OF THE UNITED NATIONS: A COMMENTARY 661, (Bruno Simma et al. eds., 1994). 42. Id. at U.N. Charter art. 51.

7 2017] Addressing Obstacles to Cyber-Attribution 541 constrained or entirely discarded. Therefore, the right to selfdefense is implicated only in the event of an armed attack, and the critical question becomes precisely what such an attack entails. As there is no established definition of armed attack in the Charter or elsewhere in treaty law, its meaning is also determined by custom. 44 Despite statements to the contrary by the International Court of Justice (ICJ), 45 there does not appear to be a consensus on precisely what an armed attack entails. 46 It is generally accepted that such an attack is more narrow than the notion of force as prohibited by Article 2(4). 47 This interpretation restricts the instances where a state is permitted to undertake self-defense to only a subset of all possible circumstances where force has been used against it. 48 The meaning of the term armed attack is therefore critical. 49 As with the prohibition against force, by framing the right to selfdefense as permissible only in response to an armed attack, the drafters of the Charter again adopted a means-based approach. 50 However, the threshold required for an armed attack is more ambiguous than for the prohibition against the use of force, but is even more important. The clearest enunciation of the threshold for an armed attack is found in the Nicaragua judgment where the ICJ first distinguished armed attacks as the most grave forms of the use of force. 51 By itself, this dictum is far from conclusive, given that the use of force is also not an especially certain concept. 52 The ICJ then gave arguably the most concrete judicial test for armed attacks when it stated that they may be distinguished from lesser uses of force 44. Nicar. v. U.S, 1986 I.C.J Id. at STANIMIR A. ALEXANDROVE, SELF-DEFENCE AGAINST THE USE OF FORCE IN INTERNA- TIONAL LAW 98 (1996). 47. Nicar. v. U.S., 1986 I.C.J. 191; Randelzhofer, supra note 41, at 663, 669. This is not the only position; however, it is the prevailing view. Id. at A clear and notable exception is the United States, which considers that any illegal use of force enlivens the right to self-defense. Abraham D. Sofaer, International Law and the Use of Force, 82 AM. SOC Y INT L L. PROC. 420, 422 (1988); TALLINN MANUAL, supra note Randelzhofer, supra note 41, at ; Nicar. v. U.S., 1986 I.C.J Randelzhofer, supra note 41, at Schmitt, supra note 33, at Nicar. v. U.S., 1986 I.C.J As one author wryly noted, Force is like pornography: the law will recognise [it when it sees it]. Silver, supra note 11, at 84; see also Jacobellis v. Ohio, 378 U.S. 184 (1964) (Silver s statement alludes to Justice Stewart s concurrence in this case wherein His Honor stipulated that while he would not, and perhaps could not, define what constitutes hardcore pornography, he nonetheless stated, I know it when I see it. ).

8 542 The Geo. Wash. Int l L. Rev. [Vol. 49 ( mere frontier incident[s] ) by their scale and effects. 53 This wording suggests that the armed force employed must be of a significant magnitude and intensity, perhaps best assessed based on the consequences that result. 54 However, the precise application of this test remains unclear. For example, in a more recent case, the ICJ expressly refused to exclude from the scope of armed attack an action on as small a scale as the mining of a single military vessel The Elements of a Right to Self-Defense As the ICJ has repeatedly emphasized, in addition to being a response to an armed attack, an act of self-defense is subject to meeting the elements of necessity and proportionality. 56 These elements are not contained within the text of Article 51, but instead are determined entirely by customary law. 57 An early but authoritative statement of these elements can be found in the diplomatic exchanges made in relation to the Caroline incident of In particular, then-u.s. Secretary of State Daniel Webster formulated necessity to require that the instigative events be instant, overwhelming, leaving no choice of means, and no moment for deliberation. 59 The effect of this requirement is that self-defense may only be undertaken when there is no realistic alternative. 60 Necessity includes an aspect of immediacy. 61 While some scholars consider immediacy to be a separate element, 62 a more common, and altogether more logical, view is that it is merely one consideration in a determination whether an act of self-defense is indeed necessary. 63 Although the immediacy aspect has signifi- 53. Nicar. v. U.S., 1986 I.C.J AVRA CONSTANTINOU, THE RIGHT OF SELF DEFENCE UNDER CUSTOMARY INTERNA- TIONAL LAW AND ARTICLE 51 OF THE U.N. CHARTER (2000). 55. Oil Platforms (Iran v. U.S.), Judgment, 2003 I.C.J. 161, 72 (Nov. 3). 56. Id. at ; Nicar. v. U.S., 1986 I.C.J. 194; Legality of the Threat or Use of Nuclear Weapons, Advisory Opinion, 1996 I.C.J. 245, 41 (July 1996); Armed Activities on the Territory of the Congo (Dem. Rep. Congo v. Uganda), Judgment, 2005 I.C.J (Dec. 19). 57. Nicar. v. U.S., 1986 I.C.J TOM RUYS, ARMED ATTACK AND ARTICLE 51 OF THE UN CHARTER: EVOLUTIONS IN CUSTOMARY LAW AND PRACTICE 92 (2010). 59. R.Y. Jennings, The Caroline and McLeod Cases, 32 AM. J. INT L L. 82, 89 (1938). 60. RUYS, supra note 58, at See Nicar. v. U.S., 1986 I.C.J See YORAM DINSTEIN, WAR, AGGRESSION, AND SELF DEFENCE 209 (2005). 63. See Nicar. v. U.S., 1986 I.C.J. 237; RUYS, supra note 58, at

9 2017] Addressing Obstacles to Cyber-Attribution 543 cance when considering necessity, 64 a degree of flexibility is required when assessing whether a response is sufficiently prompt. 65 Webster also articulated the proportionality element to require that the response involve nothing unreasonable or excessive. 66 Proportionality can be assessed one of two different ways. A qualitative view requires that the response be effectively equal in gravity with regards to casualties, damage, and the nature of the weapons employed. 67 In general, however, a functional approach prevails wherein the focus is on employing a response of an appropriate scale to suitably repel the initial armed attack. 68 Finally, arising out of the Oil Platforms case, a possible additional requirement for engaging in self-defense is that the armed attack be undertaken with the specific intention of harming the target that was ultimately attacked. 69 In that case, the ICJ noted that the explosive mine laid could not have been targeted at the specific vessel struck but simply at some target in those general waters. 70 As a result, it found the necessary intent to mount an armed attack lacking. 71 One interpretation of this element, as expressed in the judgment, is that the state which suffered the injury must actually have been the intended target. 72 The intention element is problematic as it requires the injured state to reliably infer what is essentially the state of mind of the attacking state. 73 Despite the clear enunciation found in Oil Platforms, this element remains somewhat controversial, and has essentially been rejected by the United States See Nicar. v. U.S., 1986 I.C.J. 237 (wherein the International Court of Justice (ICJ) rejected measures the United States argued were defensive on the grounds that they took place many months after the relevant attack had occurred). 65. RUYS, supra note 58, at 100; DINSTEIN, supra note 62, at Jennings, supra note 59, at RUYS, supra note 58, at 111 (using the word quantitative to describe the qualitative proportionality test described above). 68. Id. at 112; Randelzhofer, supra note 41, at Oil Platforms (Iran v. U.S.), Judgment, 2003 I.C.J. 161, 64 (Nov. 3). 70. Id. 71. Id. 72. See DINSTEIN, supra note 62, at 209 (arguing that the correct interpretation of the ICJ s decision, taken in light of the facts of the case, is that an attack which mistakenly targets the interests of a particular state does not enliven that state s right to self-defense); William H. Taft, Self-Defence and the Oil Platforms Decision, 29 YALE J. INT L L. 295, 299 (2004). 73. CONSTANTINOU, supra note 54, at Taft, supra note 72, at 299, ; TALLINN MANUAL, supra note 2, at

10 544 The Geo. Wash. Int l L. Rev. [Vol. 49 III. RESPONSES TO CYBER-ATTACK UNDER INTERNATIONAL LAW This Part reviews the application of existing international law to cyber-attack. After suffering a cyber-attack, one option of a victim state is to respond through a legally oriented process that seeks to establish that the attack was a breach of international law and that the victim state is therefore entitled to reparations. Alternatively, the state may pursue some form of self-help, such as by responding in self-defense. The following Sections discuss these approaches in turn. A. Legally Oriented State Responses Two processes of law by which a state may respond to a cyberattack exist through the United Nations. 75 Article 39 of the Charter empowers the Security Council to determine the existence of any threat to the peace, breach of the peace, or act of aggression and then to respond through non-forcible or forceful measures. 76 Additionally, Resolution 377(V), known as the Uniting for Peace Resolution, may provide some scope for a response by the General Assembly. 77 However, the legal basis for this latter response is less certain and its scope far more constrained compared with action via the Security Council. 78 In reality, the practical likelihood of either U.N. response following a cyber-attack appears relatively low. 79 There are significant obstacles that stand in the way, and these are primarily political rather than legal. 80 Therefore, these approaches are likely to remain largely theoretical in all but the most exceptional circumstances. 75. See, e.g., U.N. Charter arts ; G.A. Res. 377 (V), U.N. Doc. A/RES/377V (Nov. 3, 1950). 76. U.N. Charter arts G.A. Res. 377 (V), U.N. Doc. A/RES/377V (Nov. 3, 1950). 78. See generally Juraj Andrassy, Uniting for Peace, 50 AM. J. INT L L. 563 (1956); Harry Reicher, The Uniting for Peace Resolution on the Thirtieth Anniversary of Its Passage, 20 COLUM. J. TRANSNAT L L. 1 (1981) (emphasizing that primary responsibility for maintaining peace lies with the Security Council). 79. Randelzhofer, supra note 1, at 119; Schmitt, supra note 13, at See generally Michael N. Schmitt, Cyber Operations in International Law: The Use of Force, Collective Security, Self-Defense, and Armed Conflicts, in PROCEEDINGS OF A WORKSHOP ON DETERRING CYBERATTACKS: INFORMING STRATEGIES AND DEVELOPING OPTIONS FOR U.S. POL- ICY 151, (2010); Yaroslav Radziwill, CYBER-ATTACKS AND THE EXPLOITABLE IMPERFEC- TIONS OF INTERNATIONAL LAW (2015) (emphasizing that defining a threat to the peace is a political challenge).

11 2017] Addressing Obstacles to Cyber-Attribution Cyber-Attack as a Use of Force A more direct legal process that a victim state could pursue involves establishing that the cyber-attack was a breach of international law. States are limited in the ways they can characterize instances of cyber-aggression as a breach of international law. One such characterization is as a use of force in breach of the Charter. 81 The question surrounding this characterization that has most occupied scholars is how to determine that a cyber-attack has exceeded the threshold necessary to be force. 82 Unsurprisingly, this has proven to be a difficult question given that, even with regard to kinetic attacks, there is no conclusive definition of force. 83 As discussed above, the origin of this problem is the instrument-based approach to the framing of Article 2(4). 84 The prohibition in the instrument, rather than its consequences, is a layer of indirection, as the consequences are actually the relevant consideration. 85 As Professor Michael Schmitt notes, the normative shorthand used within the Charter does not work because a connection no longer exists between the instrument (force) and the consequences the provision seeks to prevent. 86 Some scholars have advocated the simple test that a cyber-attack must result in physical damage to qualify as force. 87 By far the most influential and highly regarded analysis, however, is that of Professor Schmitt. 88 In his seminal 1999 paper, Schmitt outlined seven criteria to determine whether a given cyber-attack may constitute a use of force. 89 These were recently adopted with relatively minor 81. U.N. Charter art. 2, Schmitt, supra note 13; Waxman, supra note 10; Roscini, supra note 2; Silver, supra note 11; Herbert S. Lin, Offensive Cyber Operations and the Use of Force, 4 J. NAT L SEC. L. & POL Y 63 (2010); Matthew C. Waxman, Cyber Attacks as Force Under UN Charter Article 2(4), 87 INT L L. STUD. SER. US NAVAL WAR COL. 43 (2011). 83. James E. McGhee, Cyber Redux: The Schmitt Analysis, Tallinn Manual and US Cyber Policy, 2 J.L. & CYBER WARFARE 64, 98 (2013). 84. See infra Section II.A. 85. Schmitt, supra note 33, at 573; BROWNLIE, supra note 37, at 362 (stating that while it is true that paragraph 4 applies to forces other than armed forces, it is very doubtful if it applies to economic measures of a coercive nature ). 86. Schmitt, supra note 33, at Silver, supra note 11, at 90; Buchan, supra note 38, at See, e.g., McGhee, supra note 83, at 67; Waxman, supra note 10, at 432; Matthew J. Sklerov, Solving the Dilemma of State Responses to Cyber Attacks: A Justification for the Use of Active Defences Against States Who Neglect Their Duty to Prevent, 201 MIL. L. REV. 1, (2009). 89. Professor Schmitt lists six criteria in the body of the text and indicates a possible seventh in a footnote. Schmitt, supra note 13, at n.81. This seventh factor is adopted in his later work and that of other scholars. Schmitt, supra note 33, at 577; TAL- LINN MANUAL, supra note 2, at

12 546 The Geo. Wash. Int l L. Rev. [Vol. 49 changes in the Tallinn Manual, 90 a consensus statement on the law of cyber-warfare by twenty academics and legal practitioners. 91 To the degree that any rules exist in this emerging area of law where there is no specific jurisprudence or clear state practice, 92 Schmitt s criteria on cyber-force are broadly accepted. 93 The criteria proposed by Schmitt are: severity, immediacy, directness, invasiveness, measurability, presumptive legitimacy, and responsibility. 94 Severity relates to the degree to which attacks involve physical injury or the destruction of property. 95 This is generally considered to be the most influential of the criteria. 96 Immediacy draws a comparison between economic coercion, which is generally not regarded as a use of force, and armed coercion, which is, and suggests that the relative speed with which the latter takes effect may be used to determine if a cyber-attack represents a use of force. 97 The criterion of directness operates similarly, observing that the consequences of armed coercion flow quite directly from the event itself, whereas the effects of economic coercion depend on multiple contributory and supervening external factors. 98 Invasiveness distinguishes a use of force from economic coercion based upon whether the act associated with the harmful outcome occurs within the target state s territory. 99 Unlike armed force, economic coercion such as the imposition of sanctions does not require any territorial intrusion on the part of the coercive state. 100 In his later analysis, Schmitt expands this notion to include the extent to which a target system is secured as a factor influencing the invasiveness of an attack. 101 However, the fundamental connection with the encroachment of territory remains, as Schmitt juxtaposes this aspect with an example of trade sanctions 90. TALLINN MANUAL, supra note 2, at Id. 92. Boer, supra note, at 5 (stating that international legal scholars played a significant role in absence of state practice and opinio juris). 93. E.g., McGhee, supra note 83, at 67; Waxman, supra note 10, at 432; Sklerov, supra note 88, at Schmitt, supra note 13, at n.81; Schmitt, supra note 33, at 576; TALLINN MANUAL, supra note 2, at Schmitt, supra note 33, at TALLINN MANUAL, supra note 2, at 48; Schmitt, supra note 33, at 576; Silver, supra note 11, at 90 91; Buchan, supra note 38, at Schmitt, supra note 13, at Id. 99. Schmitt, supra note 33, at Id Id.

13 2017] Addressing Obstacles to Cyber-Attribution 547 being noninvasive. 102 Further, he clarifies the limits of the invasiveness element by noting that espionage is not a use of force, despite its highly invasive nature. 103 Measurability involves the degree to which the consequences of an event can be ascertained, particularly in a quantitative way, which is largely a function of directness. 104 The criterion of presumptive legitimacy recognizes that, in many cases, cyber-attacks will simply be computerized variants of existing attack methodologies. 105 Schmitt argues that if computer technology is used to undertake some action that would previously not have been prohibited at international law, these computerized operations will also be legitimate. 106 This view follows the general principle that, absent some express prohibition to the contrary, at international law an act will be presumed legitimate. 107 The final criterion involves the notion that state responsibility can be a factor when evaluating cyber-attack as a use of force. 108 The historically prevailing norm is that only states can exert armed coercion. 109 Building on this, Schmitt reasons that the more closely involved a state is in a particular cyber-operation, the greater basis for other states to consider the act a use of force. 110 In his original analysis, Schmitt dismissed this factor as a practical issue of limited normative value. 111 However, Schmitt s later work recognizes that state involvement in a particular action can have a normative effect beyond the question of attribution. 112 The understanding of this seventh criterion was expanded further by the later recognition that there are actually two separate factors encompassed within it: the degree of state involvement in and the military nature of the cyber-operation. 113 The Tallinn Manual adopts this 102. Id Id Id. at Susan W. Brenner, At Light Speed : Attribution and Response to Cybercrime/Terrorism/ Warfare, 97 J. CRIM. L. & CRIMINOLOGY 379, 384 (2007) Schmitt, supra note 33, at S.S. Lotus (Fr. v. Turk.), Judgment, 1927 P.C.I.J. (ser. A) No. 10, at 19, 31 (Sept. 7) Schmitt, supra note 33, at See Schmitt, supra note 13, at 915 n See Schmitt, supra note 33, at See Schmitt, supra note 13, at 915 n.81. In forming this conclusion, it appears that Schmitt focuses primarily on the technical and factual question of attribution, rather than the normative effect of demonstrated state responsibility See Schmitt, supra note 33, at See TALLINN MANUAL, supra note 2, at 51.

14 548 The Geo. Wash. Int l L. Rev. [Vol. 49 more refined characterization of the responsibility criterion in Rule Cyber-Attack as a Wrongful Intervention An alternative theory for establishing a breach of international law involves treating acts of cyber-warfare as violations of the nonintervention principle. 115 While not expressly stated in the Charter, this principle was described by the ICJ as part and parcel of customary international law. 116 As enunciated by the ICJ in the Nicaragua case, the principle proscribes coercive intervention in matters that states should be free to decide by virtue of their sovereignty. 117 For those who might question the Schmitt criteria or insist that a cyber-attack must cause physical damage to qualify as force, the principle of nonintervention represents an alternative limb on which to establish wrongfulness. 118 If the principle of nonintervention may be used to establish wrongfulness, arguably the threshold question in relation to cyberforce is of limited significance and may be essentially moot. This outcome is somewhat ironic given that the threshold for cyberforce is perhaps the area of cyber-attack law with the greatest clarity and consensus. 119 Nonetheless, one may conclude that a cyberattack is likely to be a breach of international law under existing general rules without the need for the development of lex specialis in this area. If a cyber-attack is found to have breached international law, a legal response may require that the responsible state make full reparation for the injury caused. 120 Reparations are likely to be a comparatively appealing option for an injured state in response to a cyber-attack than they would be in relation to a kinetic attack. Cyber-attacks do not involve the element of potentially escalating territorial incursion generally found with kinetic attacks, thus 114. See id. The remainder of Rule 11 essentially reflects Schmitt s criteria; see also Boer, supra note 8, at 7 (highlighting the refined clarity of the Tallin Manual) See Buchan, supra note 38, at See Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.) 1986 I.C.J. 14, 202 (June 27) See id. at ; see also Maziar Jamnejad & Michael Wood, The Principle of Non-Intervention, 22 LEIDEN J. INTL. L. 345, (2009) (quoting Nicar. v. U.S., 1986 I.C.J., to demonstrate the relationship between coercive intervention and state sovereignty) See Buchan, supra note 38, at See supra Section III.A See G.A. Res. 56/83, Annex, Responsibility of States for Internationally Wrongful Acts, U.N. Doc. A/RES/56/83, art. 31 (Jan. 28, 2002) [hereinafter ARSIWA].

15 2017] Addressing Obstacles to Cyber-Attribution 549 reducing the importance of repelling an attack through selfdefense. Further, cyber-attacks are more likely than kinetic attacks to produce solely or predominately economic damage, making restitution of greater significance. However, in addition to the legal questions of threshold and attribution, seeking reparations will require the injured state to bring the matter before an appropriate tribunal that has both the jurisdiction to hear the case and the power to enforce its decisions. In the international arena, both issues are practically problematic. B. Self-Help and Cyber-Self-Defense As an alternative to pursuing a legal process in response to the cyber-attack, a victim state may instead employ a form of lawful selfhelp. That is, rather than becoming the basis for a legal claim, the internationally wrongful act may relieve the victim state of some of its international obligations. 121 The most prominent form of selfhelp is that of self-defense, 122 the primary focus of this Section. However, states may also employ countermeasures as a response to a cyber-attack Establishing a Cyber-Attack Although the properties of an armed attack have been discussed extensively by scholars, its precise nature remains uncertain even when considering kinetic attacks. 124 Definitional ambiguity is far more problematic when considering an armed attack, because the motivation for and consequences of the legal analysis are different. 125 When applied to cyber-armed attack, the threshold question only becomes less clear. Unlike a state that has been subject to illegal cyber-force, a state that seeks to establish itself as a victim of a cyber-armed attack very likely intends to respond forcefully in self-defense; otherwise there would be little point in seeking to establish the legal status of the attack with the higher threshold. The stakes in resolving the definitional ambiguity between cyberforce and cyber-armed attack are therefore considerably higher Int l Law Comm n, Rep. on the Work of Its Fifty-Third Session, U.N. Doc. A/56/ 10 at 71 [hereinafter ARSIWA Commentary] Id. at 74; see also supra Section II.B ARSIWA, supra note 120, art Randelzhofer, supra note 41, at Schmitt, supra note 33, at 604 (suggesting that the prohibition on the use of force has adapted better to the advent of cyber-attack than the notion of armed attack).

16 550 The Geo. Wash. Int l L. Rev. [Vol. 49 In contrast to the broad acceptance of Schmitt s criteria with respect to the use of force, there is no consensus regarding a test for cyber-armed attack. 126 Schmitt has proposed that, to qualify as cyber-armed attack, an incident must result in physical damage, 127 such as the destruction of data designed to be converted into tangible objects. 128 This test does not assist in delineating the boundary between a use of cyber-force and cyber-armed attack; it is very similar to the test for armed force which Schmitt presents earlier in the same paper. 129 Further, some academics view physical damage as the defining element of a use of cyber-force. 130 Another simple and relatively uncontroversial test advocated by cyber-policy specialist Herbert Lin and others extends the existing notion of cyber-armed attack to encompass cyber-incidents. 131 That is, if the effects of a cyber-attack would be sufficient to qualify the attack as an armed attack if produced by kinetic means, then the cyber-incident will also qualify as a cyber-armed attack. 132 Professor Yoram Dinstein argues that, From a legal perspective, there is no reason to differentiate between kinetic and electronic means of attack.... The crux of the matter is not the medium at hand... but the violent consequences of the action taken. 133 Similarly, national security law expert Matthew Waxman suggests there is at least a U.S. consensus that a cyber-attack will be an armed attack where its features and consequences closely resemble those of traditional military force. 134 This approach is essentially a continuation of the consequences-based model for interpreting rules framed in terms of the instrument employed. 135 However, in their article on cyber-warfare, John Dever and James Dever reject this approach, arguing that existing concepts are inadequate to prop Id. at Id. at Id. (giving banking information as an example of such data) Id. at 573. Schmitt s test for armed force does not expressly exclude attacks with nonphysical consequences, but that is its natural implication. Schmitt suggests that all uses of armed force will constitute an armed attack. See id. at 575. However, he does not impliedly reference the doctrine that all unlawful uses of force may be construed as armed attacks because he structures his analysis in two separate sections, entitled Uses of Force and Armed Attack. See id. at , Buchan, supra note 38, at 212; Silver, supra note 11, at Lin, supra note 82, at 63; see also Roscini, supra note 2, at Lin, supra note 82, at 73; see also Roscini, supra note 2, at Yoram Dinstein, Computer Network Attacks and Self-Defence, in 76 COMPUTER NET- WORK ATTACK & INTERNATIONAL LAW 99, 103 (Michael N. Schmitt & Brian T. O Donnell eds., 2002) Waxman, supra note 82, at See supra Sections II.A, III.A.1.

17 2017] Addressing Obstacles to Cyber-Attribution 551 erly characterize the nuances of cyber-attack. 136 Schmitt notes that opinion is divided as to the nature of cyber-armed attack, particularly where an incident does not cause physical damage but nonetheless produces severe outcomes. 137 Emerging state practice suggests that the scope of armed attack in cyber-scenarios is likely to expand, although where these new boundaries will lie is far from clear The Elements of Self-Defense The writings of scholars in this field suggest that the law in relation to the necessity and proportionality elements of self-defense as applied to cyber-attack is relatively straightforward and settled. For example, Dinstein s analysis of this matter deals with necessity in a short paragraph, and is also brief when discussing proportionality. 139 Similarly, Rule 14 of the Tallinn Manual hints at few controversies. 140 However, these issues are not quite as straightforward as they might appear. First, several issues emerge from the necessity element. The requirement of necessity implies that there is no alternative to a use of force to repel an attack that is either imminent or underway. 141 On this basis, the general absence of physical territorial incursion in the case of cyber-attacks suggests that the necessity element may be fundamentally difficult to establish. The immediacy aspect of necessity may also be particularly problematic in relation to computer attacks. For these attacks, many basic parameters that are normally readily apparent may remain unclear for some time. For example, the beginning or even the very existence of the attack may not be initially identifiable, as in the case of malware or direct intrusion. 142 In other cases, denial of service attacks may occur intermittently, making it difficult to say whether these constitute a single attack and, if so, whether the attack is still ongoing. These properties significantly complicate the process of deciding when a response in self-defense would be sufficiently immediate and necessary. Obstacles to reliably ascer Dever & Dever, supra note 20, at Schmitt, supra note 3, at Id. at Dinstein, supra note 133, at See TALLINN MANUAL, supra note 2, at Jennings, supra note 59, at 89; TALLINN MANUAL, supra note 2, at ( The key to the necessity analysis in the cyber context is, therefore, the existence, or lack, of alternative courses of action that do not rise to the level of a use of force. ) 142. TALLINN MANUAL, supra note 2, at 66 10; McGhee, supra note 83, at 100.

18 552 The Geo. Wash. Int l L. Rev. [Vol. 49 taining attribution and characterizing the type of attack may introduce further delays. 143 Second, proportionality raises additional concerns. Proportionality limits the force employed to only what is necessary to successfully mount a defense in the circumstances. 144 On this point, notably, scholars appear to be in general agreement that kinetic and cyber- uses of force are completely equivalent and interchangeable as defensive measures. 145 Dinstein makes this claim as a blanket statement, providing neither supporting authorities nor logical argument. 146 The expert authors of the Tallinn Manual also agree with this view: they repeat the claim several times in different contexts throughout the commentary on Rule While it is generally accepted that the proportionality requirement does not limit an injured state to a response that is qualitatively the same as that employed by the aggressor, 148 it seems improbable and anomalous that the application of this functional model of proportionality to cyber-attack should be so simple and uncontentious. For instance, putting aside the questions of definition and attribution, if Iran had chosen to retaliate against Israel using kinetic force in response to the Stuxnet worm, 149 the proportionality of this response would be regarded by certain sectors of the international community as at least contentious purely because Iran was the first to resort to kinetic weaponry. This is not to suggest that a state which is the victim of a serious cyber-armed attack should be precluded from employing kinetic force in defense. However, contrary to the apparent views of scholars, it seems likely in those circumstances that the proportionality of any response would be legally contentious. Finally, to assess the proportionality of any response, it is necessary to demarcate precisely what constitutes the initial cyber-armed 143. McGhee, supra note 83, at 81; Shackelford & Andres, supra note 10, at Jennings, supra note 59, at 89; TALLINN MANUAL, supra note 2, at (indicating that [t]he criterion limits the scale, scope, duration, and intensity of the defensive response.... [but] [i]t does not restrict the amount of force used to that employed in the armed attack.... ) See, e.g., Dinstein, supra note 133, at 108; TALLINN MANUAL, supra note 2, at , Dinstein, supra note 133, at TALLINN MANUAL, supra note 2, at , RUYS, supra note 58, at For information on the Stuxnet worm, see generally Irving Lachow, Stuxnet Enigma: Implications for the Future of Cybersecurity, 11 GEO. J. INT L AFF. 118 (2010); Richardson, supra note 3. Stuxnet is regarded as a use of force, rising to the level of an armed attack. See Buchan, supra note 38, at ; Schmitt, supra note 2, at 45 9,

19 2017] Addressing Obstacles to Cyber-Attribution 553 attack. Dinstein suggests that the accumulation of events theory may apply to this problem. 150 However, this theory is far from universally accepted by scholars, 151 and has been rejected numerous times by the U.N. Security Council. 152 Although the ICJ has seemingly accepted the notion that an accumulation of events can constitute an armed attack, 153 the court has been more reluctant to conclude that an accumulation of events may be used when evaluating the proportionality of a given response. 154 The relatively amorphous nature of cyber-attacks further complicates the task of analyzing the magnitude of an initial armed attack to determine a suitably proportionate response. 3. The Significance of Economic Damage A key difference between instances of kinetic aggression and cyber-attack is the focus on immediate physical damage in relation to the former and the heightened significance of economic damage to the latter. 155 Cyber-attacks can produce physical consequences, but so far these have been extremely rare. 156 Therefore, many cyber-attacks are likely to produce primarily or exclusively economic damage. 157 As noted, cyber-attacks lack the element of potentially escalating territorial incursion by military assets or personnel, diminishing the relevance of traditional state defense 150. Dinstein, supra note 133, at 109. The accumulation of events theory considers that a series of temporally proximate small-scale attacks may be viewed in aggregate for the purposes of assessing whether they exceed the relevant threshold, particularly in relation to armed attack. Id Ian Brownlie, The Use of Force in Self-Defence, 37 BRIT. Y.B. INT L L. 183, 245 (1961) Derek Bowett, Reprisals Involving Recourse to Armed Force, 66 AM. J. INT L. L. 1, 6 8 (1972). But see DINSTEIN, supra note 62, at 202, ; RUYS, supra note 58, at ; Roberto Ago, Addendum to the Eighth Report on State Responsibility, 2 YEARBOOK OF THE INTER- NATIONAL LAW COMMISSION 13, (1980) See Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.) 1986 I.C.J. 14, 231 (June 27); Oil Platforms (Iran v. U.S.), Judgment, 2003 I.C.J. Rep. 161, 64 (Nov. 3); TALLINN MANUAL, supra note 2, at Armed Activities on the Territory of the Congo (Dem. Rep. Congo v. Uganda), Judgment, 2005 I.C.J. Rep (Dec. 19) Priyanka R. Dey, Use of Force and Armed Attack Thresholds in Cyber Conflict: The Looming Definitional Gaps and the Growing Need for Formal U.N. Response, 50 TEX. INT L L.J. 381, (2015) Richardson, supra note 3, at 8 (noting that Stuxnet is regarded as the first cyberattack aimed at a state that has caused tangible physical damage). More recently, an entirely digital attack caused substantial damage to a German steel factory, and this has been reported as the second cyber-attack with physical consequences. Kim Zetter, A Cyberattack Has Caused Confirmed Physical Damage for the Second Time Ever, WIRED (Jan. 8, 2015, 5:30 AM), [ perma.cc/xc28-mn6f] See Hathaway, supra note 12, at , 840.